User and group administration underpins access control. New accounts are created with useradd -m -s /bin/bash john (the -m flag provisions a home directory), passwords set with passwd john, group memberships extended with usermod -aG sudo john, and accounts removed with userdel -r john (which deletes the home directory too). The commands id john and whoami reveal UID, GID, group memberships, and the current user. Information about accounts lives in /etc/passwd, encrypted passwords in /etc/shadow, and groups in /etc/group (with /etc/gshadow storing group passwords). Each user has exactly one primary group and may belong to many supplementary groups; groupadd, groupdel, usermod -aG, gpasswd -d, and groups manipulate these.
Privilege escalation is mediated by sudo, configured through /etc/sudoers — always edited via visudo, which validates the syntax. Entries follow user host=(runas) commands: root ALL=(ALL:ALL) ALL is the default, %sudo ALL=(ALL:ALL) ALL grants every member of the sudo group full access, and alice ALL=(ALL) NOPASSWD: /usr/bin/systemctl restart nginx lets alice restart nginx without re-typing her password. Customizations are best kept in drop-in files inside /etc/sudoers.d/. Defaults like Defaults env_reset, timestamp_timeout=5, and log_input, log_output shape caching and auditing, while audits live in the journal (journalctl -u sudo) or /var/log/auth.log. Beyond the root-or-not binary, Linux capabilities split superuser privileges into roughly forty discrete powers (CAP_NET_BIND_SERVICE, CAP_SYS_ADMIN, CAP_DAC_OVERRIDE, and so on) that can be granted to a binary with setcap cap_net_bind_service=+ep /usr/bin/python3, so an unprivileged program can bind port 80 without running as root. getcap and getpcaps inspect them.
Mandatory access control adds an extra layer on top of standard Unix permissions. SELinux, dominant on RHEL-family systems, assigns every process and file a security context and enforces type-enforcement rules: it can run in enforcing (deny by default), permissive (log only), or disabled. Status is checked with getenforce and sestatus; modes are switched with setenforce 0|1 and made persistent in /etc/selinux/config. File contexts appear as -Z on ls and ps, are changed with chcon -t httpd_sys_content_t /var/www/html/file, and reset to the policy default with restorecon -R. Denial analysis uses sealert -a /var/log/audit/audit.log, while audit2why and audit2allow generate policy from observed violations. AppArmor, default on Ubuntu, is path-based and simpler: profiles live in /etc/apparmor.d/, with commands like aa-status, aa-complain, aa-enforce, and apparmor_parser -r managing enforcement.
The boot sequence ties everything together. After POST, the firmware (BIOS or UEFI) hands off to the bootloader — GRUB reads /boot/grub/grub.cfg on legacy BIOS or /boot/efi/EFI/... on UEFI, presenting a menu where e edits a kernel line and c opens a GRUB shell. The kernel loads an initramfs (a compressed cpio archive in /boot) that contains just enough modules to mount the real root, assemble software RAID, activate LVM, or unlock LUKS, then hands control to PID 1 — on modern systems, systemd — which resolves target dependencies, mounts filesystems from /etc/fstab, brings up networking, and starts services before getty spawns login prompts. The initramfs can be regenerated with update-initramfs -u on Debian/Ubuntu or dracut -f on RHEL, and an installed image can be listed with lsinitramfs. When the system fails to reach multi-user.target, systemctl --failed highlights the broken unit, journalctl -xb -p err shows error-level boot logs, and appending systemd.unit=rescue.target or systemd.unit=emergency.target at the GRUB prompt drops to progressively more minimal shells for repair. GRUB itself can be reinstalled from a Live USB by chrooting into the mounted root and running grub-install /dev/sda followed by grub-mkconfig -o /boot/grub/grub.cfg.